feat(sftpgo): add TLS support and internal certificate management

terraform/modules/apps/sftpgo/main.tf

@@ -4,6 +4,27 @@ resource "kubernetes_namespace" "sftpgo" {
   }
 }
 
+resource "kubernetes_manifest" "internal_cert" {
+  count = var.tls_enabled ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "internal-cert"
+      namespace = kubernetes_namespace.sftpgo.metadata[0].name
+    }
+    spec = {
+      secretName = "internal-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = var.fqdn
+      dnsNames   = [var.fqdn]
+    }
+  }
+}
+
 resource "kubernetes_config_map" "sftpgo" {
   metadata {
     name      = "sftpgo"
@@ -121,12 +142,13 @@ resource "kubernetes_deployment" "sftpgo" {
           }
           port {
             container_port = 8081
-            name           = "webdav"
+            name           = "dav"
             protocol       = "TCP"
           }
+
           port {
             container_port = 8080
-            name           = "http"
+            name           = "web"
             protocol       = "TCP"
           }
           port {
@@ -166,6 +188,14 @@ resource "kubernetes_deployment" "sftpgo" {
             sub_path   = "credentials"
             read_only  = true
           }
+          dynamic "volume_mount" {
+            for_each = var.tls_enabled ? [1] : []
+            content {
+              mount_path = "/etc/ssl/certs/private"
+              name       = "internal-cert"
+              read_only  = true
+            }
+          }
         }
         volume {
           name = "config"
@@ -191,6 +221,15 @@ resource "kubernetes_deployment" "sftpgo" {
             name = kubernetes_config_map.object_store_credentials.metadata[0].name
           }
         }
+        dynamic "volume" {
+          for_each = var.tls_enabled ? [1] : []
+          content {
+            name = "internal-cert"
+            secret {
+              secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
+            }
+          }
+        }
       }
     }
   }
@@ -206,17 +245,18 @@ resource "kubernetes_service" "sftpgo_webdav" {
       app = "sftpgo"
     }
     port {
+      name        = var.tls_enabled ? "davs" : "dav"
       protocol    = "TCP"
-      port        = 8081
-      target_port = "webdav"
+      port        = var.tls_enabled ? 443 : 80
+      target_port = "dav"
     }
     cluster_ip = "None"
   }
 }
 
-resource "kubernetes_service" "sftpgo_http" {
+resource "kubernetes_service" "sftpgo_web" {
   metadata {
-    name      = "http"
+    name      = "web"
     namespace = kubernetes_namespace.sftpgo.metadata[0].name
   }
   spec {
@@ -225,9 +265,9 @@ resource "kubernetes_service" "sftpgo_http" {
     }
     port {
       protocol    = "TCP"
-      port        = 8080
-      target_port = "http"
+      port        = var.tls_enabled ? 443 : 80
+      target_port = "web"
     }
-    cluster_ip = "None"
+    type = "ClusterIP"
   }
 }